Government Use of Cloud Computing Legal Challenges

Transcription

1 Government Use of Cloud Computing Legal Challenges Liesbeth Hellemans ICRI/CIR KU Leuven IAPP Europe Data Protection Congress

2 Agenda 1. Cloud for Europe project 2. Legal Challenges of Public Sector Cloud Computing 3. Legal recommendations for Public Sector Cloud Computing Policy-oriented In practice 2

3

4 Public sector cloud use as a collaboration between public authorities and industry through pre-commercial procurement 4

5 Mission Cloud for Europe brings together public authorities and industry to support public sector cloud use. Identify obstacles for cloud use in the public sector Define services that overcome those obstacles Procure research from industry to find innovative solutions for cloud services 5

6 Partners

7 Legal challenges of Public Sector Cloud Computing 7

8 Methodology Literature overview (current & future legal framework) Due diligence consortium partners Austria, Belgium, Portugal, Spain, The Netherlands, Norway Public sector aspects - Languages - Public procurement - Archiving - Procedural law (criminal and social) - Medical law - Bookkeeping/fiscal - National Defense and State secrets Legal challenges experienced by consortium partners 8

9 Categories of challenges 2 categories Common to most cloud services Public sector specific Non-exhaustive 9

10 Legal challenges common to most cloud services Applicable law & jurisdiction Consumer Protection Data Protection Government cloud Data Portability/ Interoperability Contractual framework Liabiility

11 Public Sector specific legal challenges Governmental Access Legislation discouraging cloud transfer Inaccurate Procurement legislation Government cloud Fragmented and divering national legislation Language requirements National defense/state secrets

12 Legal Recommendations for Public Sector Cloud Computing 12

13 13 Policy - oriented

14 Regulatory Review, clarify and harmonize legislation in public domain related areas to make it cloud-friendly Address the issues on governmental environment and intelligence gathering at European and international level Issue clear guidelines when uncertainty on the conditions of cloud use Further harmonize and simplify public procurement rules Set up a cross-border working group between legal specialists and technological teams to address encryption standards Further harmonize and modify data protection legislation to reflect the reality of cloud computing Set up a code of conduct for governments as Cloud Consumers, providing for a clear overview of cloud prerequisites for the public sector, including a set of minimum contractual standards Set up a code of conduct to provide guidelines in the relationship Public Authority Cloud End User 14

15 Legislation Execution Cloud Services Develop Legislation Executing Cloud Services addressing and overcoming legal cloud barriers by accomplishing certain legal requirements 15

16 16 In practice

17 Key attention points Cross-border cloud: set up a contractual collaboration model between governments (liability!) Federal/regional cloud: set up a contractual collaboration model between the various government Assess the needs and practical way of working (call-offs?) Comply with local Public Procurement legislation Conduct a comprehensive and thorough risk analysis Sensitivity of the data? Indicate and specify the location of the data centres Preference Europe Transfer outside the EEA? Location support services? Segregate the duties sufficiently Division of cloud project in various lots 17

18 Key attention points Define language requirements Pay specific attention to the danger of lock-in stand-by Cloud Provider? Encrypt all data and ensure the encryption key sits with the public authorities Choose a Cloud Provider that complies with data protection legislation (third party certification) Define appropriate minimum SLA s Sign an appropriate contractual framework addressing both general contract and data privacy requirements Negotiate Unlimited access to the data Accountability rules Data protection concerns Address Cloud End User concerns Security/confidentiality/IPR/privacy protection data protection policy Redress mechanisms 18

19 19 Source?

20 Downloads: Legal Implications of Cloud Computing Contact: 20

21